Executive Cybersecurity Misalignment Risks Business Stability and Growth, Reveals EY Study

Executive Cybersecurity Misalignment Risks Business Stability and Growth, Reveals EY Study

Summary

• Significant disconnect: An April 2025 EY survey of 800 U.S. executives found CISOs and other C-suite leaders see cyber risk very differently.
• Impact on business: EY says the gap puts business value and resilience at risk.
• Leadership challenges: CISOs and the rest of the C-suite disagree on threats, incidents and budgets.
• Emerging threats: Most CISOs think threats are outpacing their defenses.

CISOs and the C-suite see different risks

EY’s 2025 cybersecurity study found a wide gap between chief information security officers and the rest of the C-suite. The firm surveyed 800 U.S. C-level executives, 300 of them CISOs and 500 in other senior roles, and found the two groups disagree on how serious the threats are and what it will take to deal with them.

The numbers show the gap. 68% of CISOs said senior leaders underestimate cyber risk, compared with 57% of other executives. 66% of CISOs said threats are outpacing their defenses, against 56% of the wider C-suite. CISOs also reported more incidents from cybercriminals (57% vs. 47%) and from insiders (47% vs. 31%).

Security as a business issue

Budgets show the split too. 82% of CISOs expected seven-figure security budgets next year, compared with 53% of other executives. That’s a big difference in expectations heading into planning season.

EY argues that cybersecurity should be tied to business goals, and that companies treating it as a pure IT cost are missing how much it affects growth and reputation.

Closing the communication gap

The gap is mostly about communication. CISOs need to explain risk in business terms, and other executives need to bring security leaders into strategy discussions early, not after decisions are made.

A quote attributed to an unnamed executive in an earlier version of this article could not be confirmed in EY’s published materials and has been removed. The study’s broader point stands: managing cyber risk is part of running the business.

Threats keep growing

Threats such as ransomware and supply chain attacks keep getting more sophisticated. The survey shows CISOs feel that pressure more sharply than their peers.

Security leaders need to keep reassessing their defenses. Training staff across the company also helps, because many attacks start with a person, not a server.

Getting on the same page

EY’s findings suggest many companies need to rethink how security fits into their business model, starting with getting the CISO and the rest of the executive team to agree on what the risks are.

The fix isn’t complicated. Shared metrics, regular briefings and a CISO with a real seat at the table go a long way, and companies that do this will make better decisions about where to spend.

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.